As Russians hack the US grid, a look at what's needed to protect it

The high-voltage lines carrying electricity across the U.S. aren't the only potential targets.Rolypolyman

The U.S. electricity grid is hard to defend because of its enormous size and heavy dependency on digital communication and computerized control software. The number of potential targets is growing as "internet of things" devices, such as smart meters, solar arrays and household batteries, connect to smart grid systems.

As researchers ofgrid security, we believe that current security standards mandated by federal regulations provide sufficient protection against observed threats. But recent incidents demonstrate the ongoing challenge of ensuring everyone follows the guidelines, which themselves must change over time to keep up with technological shifts.

In addition, human errors will inevitably lead to mistakes that will weaken the security of some of the thousands of digital devices needed to protect the grid. And more sophisticated attackers may still find and exploit currently unknown vulnerabilities. Therefore, it's important for electric utilities, grid operators and vendors to remain vigilant and deploy multiple layers of defense.

Major players have some protections

There are two main aspects to grid architecture that need defending in different ways. The first element is the bulk power system, often referred to as the "transmission grid." It connects high-capacity power plants, transmission wires and substations that collectively generate and transport huge quantities of electricity over hundreds or thousands of miles. The rest of the grid is made up of smaller distribution grids - connected with the bulk power system - delivering electricity to homes and businesses around the country. The strongest standards for protection apply only to the bulk power system; though many distribution systems follow the same guidelines, they remain optional.

Companies operating power plants, like this one in Oklahoma, need to remain on top of cybersecurity threats.AP Photo/Sue Ogrocki

Smaller companies are more vulnerable

Because transmission grid utilities should already have some protections against network intrusions, it is likely that the Russian hackers looked elsewhere, infiltrating smaller distribution utilities. If that's so, any potential power shutdown or other problems in those systems would be confined to smaller areas - like towns or cities. That, in turn, means fewer customers would be affected, with less work needed to get power back on.

But it highlights a worrying reality: Smaller and midsized companies that operate electricity distribution systems often have inadequate resources to invest in full cybersecurity protections. The more than 3,000 utilities in the U.S. have trouble finding sufficiently skilled workers who understand how the computerized and physical components of the grid work together and how to protect them.

In addition, utilities rely on complex supply chains to provide equipment, software, maintenance and other business functions. These external contractors and vendors may not implement protections as rigorous as the utilities. And their computer systems often have connections to the utilities' networks, which may be considered trusted and safe, rather than potential avenues of attack.

Stepping up defenses

Fixing all these potential problems is complex. First, all utility companies - even the smallest - should adopt basic security protections like those required of large utilities. Some states are moving to require this of the power companies serving their residents, but many aren't yet. Further, we recommend all companies that are part of the grid participate in coordinated grid exercises to improve cybersecurity preparedness and share best practices.

It won't be enough to protect against today's threats. Adversaries are likely to employ increasingly sophisticated techniques that exploit both computer and human vulnerabilities. Companies need to ensure they engage in what might be called sustainable cybersecurity - ongoing processes that let systems and staff adapt over time, to stay ahead of the threats.

Researchers have an important role too, exploring ways that emerging technologies like cloud computing, blockchain and big-data analytics could help reduce risks without introducing any additional weaknesses. Further, researchers should identify more advanced ways to secure the grid, and reduce these systems' complexity, which would limit both current risks and future unknowns.

Manimaran Govindarasu receives funding from US Department of Energy, US National Science Foundation, and US Department of Homeland Security. He is affiliated with Institute for Electrical and Electronics Engineers (IEEE), Power System Engineering Research Center (PSERC), and Illinois Commerce Commission's NextGrid Study Group.

Adam Hahn receives funding from the US Department of Energy, US National Science Foundation, and US Department of Homeland Security. He is affiliated with the Institute for Electrical and Electronics Engineers (IEEE), and the Illinois Commerce Commission's NextGrid Study Group.